From 250b13bc96aef357d791a3dfe3bb4e0f9620d0c3 Mon Sep 17 00:00:00 2001 From: Eileen McNaughton Date: Wed, 15 Mar 2023 09:08:27 +1300 Subject: [PATCH] dev/core#4184 Fix Import over-authorization --- ext/civiimport/Civi/Api4/Event/Subscriber/ImportSubscriber.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ext/civiimport/Civi/Api4/Event/Subscriber/ImportSubscriber.php b/ext/civiimport/Civi/Api4/Event/Subscriber/ImportSubscriber.php index 4ee6bbbe5e..0eade33f0d 100644 --- a/ext/civiimport/Civi/Api4/Event/Subscriber/ImportSubscriber.php +++ b/ext/civiimport/Civi/Api4/Event/Subscriber/ImportSubscriber.php @@ -104,7 +104,7 @@ class ImportSubscriber extends AutoService implements EventSubscriberInterface { public function onApiAuthorize(AuthorizeEvent $event): void { $apiRequest = $event->getApiRequest(); $entity = $apiRequest['entity']; - if (strpos($entity, 'Import_') === 0) { + if (strpos($entity, 'Import_') === 0 && !in_array($event->getActionName(), ['getFields', 'getActions', 'checkAccess'], TRUE)) { $userJobID = (int) (str_replace('Import_', '', $entity)); if (!UserJob::get(TRUE)->addWhere('id', '=', $userJobID)->selectRowCount()->execute()->count()) { throw new UnauthorizedException('Import access not permitted'); -- 2.25.1